Package net.shibboleth.oidc.security.impl

Class ClientInformationJWTTrustEngine

  • All Implemented Interfaces:
    TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>, TrustEngine<com.nimbusds.jwt.SignedJWT>
    public class ClientInformationJWTTrustEngine
extends ExplicitKeySignedJWTTrustEngine
implements TrustedCredentialTrustEngine<com.nimbusds.jwt.SignedJWT>
    An implementation of SignatureTrustEngine which evaluates the validity and trustworthiness of JWT signatures.

    This extends ExplicitKeySignedJWTTrustEngine by adding a configurable lookup strategy for the signature algorithm that must be used in the incoming token. Also a default value can be set if the function returns no value. If neither function is returning value nor the default value is set, then any signature accepted by the parent class is accepted.

    Since:
    2.2.0

    • Field Detail

      • log

        private final org.slf4j.Logger log
        Class logger.

      • signatureAlgorithmLookupStrategy

        @Nonnull
private final Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,​String> signatureAlgorithmLookupStrategy
        A lookup function for the signature algorithm in the client metadata.

      • defaultAlgorithmValue

        @Nullable
private final String defaultAlgorithmValue
        The default algorithm value used if lookup strategy returned null.

    • Constructor Detail

      • ClientInformationJWTTrustEngine

        public ClientInformationJWTTrustEngine​(@Nonnull @ParameterName(name="resolver")
                                       CredentialResolver resolver,
                                       @Nonnull @ParameterName(name="JOSEObjectResolver")
                                       JOSEObjectCredentialResolver joseObjectResolver,
                                       @Nonnull @ParameterName(name="signatureAlgorithmLookupStrategy")
                                       Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,​String> strategy,
                                       @Nullable @ParameterName(name="defaultAlgorithmValue")
                                       String defaultValue)
        Constructor.
        Parameters:
        resolver - credential resolver used to resolve trusted credentials.
        joseObjectResolver - resolver which resolve credentials from the headers of a JOSEObject instance.
        strategy - lookup strategy for the signature algorithm in the client metadata.
        defaultValue - the default signature algorithm value.

    • Method Detail

      • doValidate

        protected boolean doValidate​(@Nonnull
                             com.nimbusds.jwt.SignedJWT signedJWT,
                             @Nonnull
                             CriteriaSet trustBasisCriteria)
                      throws SecurityException
        Validate the signed JWT using the supplied trust criteria.
        Overrides:
        doValidate in class ExplicitKeySignedJWTTrustEngine
        Parameters:
        signedJWT - the signed JWT to validate
        trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation
        Returns:
        true if signature is valid and trusted, false otherwise
        Throws:
        SecurityException - if there is a fatal error evaluating the signature

      • getExpectedAlgorithm

        @Nullable
protected String getExpectedAlgorithm​(@Nonnull
                                      ClientInformationCriterion criterion)
        Fetches the expected signature algorithm from the OIDCClientInformation.
        Parameters:
        criterion - criterion containing the client information/metadata.
        Returns:
        the expected algorithm value.